topic Re: How to remove decimal places without rounding in Splunk Search

How to remove decimal places without rounding

g038123 — Thu, 04 Jan 2018 21:34:17 GMT

Hello,
I have the following field values returned from a base search

Field Name
14.2
19.95
InvalidCompositeMsmtA
0
5.6
CompositeIndexInitializing

I need to remove the decimal places without rounding, so the results show as below, which would match what our application displays.

Field Name
14
19
InvalidCompositeMsmtA
0
5
CompositeIndexInitializing

Thank you in advance for any assistance you can provide.

Re: How to remove decimal places without rounding

outcoldman — Thu, 04 Jan 2018 23:00:27 GMT

You are looking on something like

... | eval InvalidCompositeMsmtA=floor(InvalidCompositeMsmtA)

You can find the documentation about floor http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/MathematicalFunctions#floor.28X.29

Re: How to remove decimal places without rounding

somesoni2 — Thu, 04 Jan 2018 23:01:43 GMT

The output format you've put may be little confusing. What are the names of the fields that contains those decimal values? Are the names of those columns fixed/static? There is a function called floor which can just bring it down to next lower integer number (no rounding, floor(19.99) will be 19 ).

Re: How to remove decimal places without rounding

sloshburch — Fri, 05 Jan 2018 13:22:10 GMT

Floor, ceiling, round, or if needed, you could string parse it to chop off everything from decimal after. As @somesoni2 highlight, the formatting of the original post is funky so it's a bit hard to understand if these answers are helping.

Re: How to remove decimal places without rounding

g038123 — Fri, 05 Jan 2018 15:21:05 GMT

Hey, sorry for the confusion, to clarify I have a field named "Index"(Named "Field Name" in original post)
The values of the Index field can be numeric or string as below
14.2
19.95
InvalidCompositeMsmtA
0
5.6
CompositeIndexInitializing

I don't really care about the strings, they're temporary and will update to a numeric value after enough readings have posted. For the purposes of my report, they will generally be ignored.

I do care about the numeric values and would like them to display identical to what is displayed on our application. Floor worked perfectly as I do not want the values rounded, thank you for that!

Given the same data values, if I did need to only update the numeric values and leave the strings untouched, how would I do that? Just curious for future reference and if by chance the requester of the data asks for it. 😉

Re: How to remove decimal places without rounding

somesoni2 — Fri, 05 Jan 2018 15:33:07 GMT

Try like this

your current search | eval "Field Name"=if(match('Field Name',"^[\d\.]*$"),floor('Field Name'),'Field Name')

Re: How to remove decimal places without rounding

g038123 — Fri, 05 Jan 2018 19:37:38 GMT

Perfect, Thank you!!

Re: How to remove decimal places without rounding

sloshburch — Mon, 08 Jan 2018 12:12:46 GMT

Check the functions for the eval command and you will discover that you can play with Informational Functions and the Comparison and Conditional functions to test if a value is a string (hint: isstr ) or is a number (hint: isnum ) and then perform the floor only on the numbers.

If you need more help, come back here, but I figured you wanted to learn more about the options available than just this specific answer (teach you to fish).

Re: How to remove decimal places without rounding

g038123 — Tue, 09 Jan 2018 16:36:38 GMT

Perfect! Thank you Burch
And yes, I'd rather fish 😉

Re: How to remove decimal places without rounding

vikashperiwal — Wed, 30 Sep 2020 00:40:17 GMT

i tried doing this way, i want t remove decimal places without rounding. but this did nt work

index=xyx host=* source=abc
| eval new_time = uptime/86400 | timechart span=1day avg(new_time) as Days by host| eval Days=if(match('Days',"^[\d.]*$"),floor('Days'),'Days')

Re: How to remove decimal places without rounding

sloshburch — Tue, 02 Jul 2019 15:44:57 GMT

@vikashperiwal - time is a bit "fun" to play with and I suggest making a whole new post for that question (and then share the link here so we can help you) so we can dive deep with you.

There could be a number of options or approaches depending on your situation. For example, your question could be solved with a tweak to the sourcetype (to modify the time) that could solve your challenge with the `date*` fields.